DivX player versions 2.6 and below allow for arbitrary file overwriting via a flaw in handling skins.